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AMENDMENTS TO THE CLAIMS: 

Tiiis listing of claims will replace all prior versions and listings of claims in the 
application: 

1 . (Currently Amended) A method for detecting a wireless access device on a 
network, said method comprising: 

receiving from the network a packet with an address; and 

indicating that the received packet con-esponds to the wireless access device 

based on the first three octets of the address and on an operating system 

associated with the received packet. 

2. (Currently Amended) A method for detecting a wireless access device on a 
network, said method comprising: 

receiving from the network a packet with an address; comparing the address with 

one or more registered addresses; 
determining an operating system associated with the address, when said 

comparing the address results in a match between the address and at 

least one of the registered addresses; 
comparing the determined operating system with one or more stored operating 

systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
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indicating tliat tlie received packet corresponds to the wireless access device 
based on the first three octets of the address and when the determined 
operating system matches at least one of the stored operating systems. 

3. (Original) The method of claim 2, wherein said receiving further comprises: 
receiving the address with information identifying a source of the packet. 

4. (Original) The method of claim 3, further comprising: 

using an organizationally unique identifier as the infonnation identifying the 
source. 

5. (Original) The method of claim 2, wherein said receiving further comprises: 
receiving the address based on passively monitoring the networic. 

6. (Original) The method of claim 2, wherein comparing the address further 
comprises: 

detemiining whether a portion of the address is similar to a portion of at least one 
of the registered addresses. 

7. (Original) The method of claim 2, wherein comparing the address further 
comprises: 



-3- 



Application No. 10/645,388 
Attorney Docket No. 03-8005 
Customer No. 25,537 

determining whether a first organizationally unique identifier of the address is 

similar to a second organizationally unique identifier of at least one of the registered 

addresses. 

8. (Original) The method of claim 2, wherein determining the operating system 
further comprises: 

determining the operating system at the Intemet Protocol address associated 
with the address. 

9. (Original) The method of claim 8, wherein determining the operating system 
further comprises: 

determining the operating system using an nmap. 

10. (Original) The method of claim 2, wherein said indicating further comprises: 
indicating the wireless access device is not authorized on the network. 

1 1 . (Original) The method of claim 2, further comprising: 

storing the one or more registered addresses, such that the one or more 
registered addresses are searchable. 

12. (Original) The method of claim 2, further comprising: 
storing a portion of at least one of the registered addresses. 



Application No. 10/645,388 
Attorney Docket No. 03-8005 
Customer No, 25,537 

13. (Original) The method of claim 12, further comprising: 
using an organizationally unique identifier as the portion. 

14. (Original) The method of claim 13, further comprising: 

storing a plurality of the organizationally unique identifiers, such that the 
organizationally unique identifiers are searchable. 

15. (Original) The method of claim 14, further comprising: 

storing the plurality of the organizationally unique identifiers, such that a more 
frequently encountered organizationally unique identifier is searched before a less 
frequently encountered organizationally unique identifier. 

16. (Original) The method of claim 2, further comprising: 

storing the stored operating systems, such that a more frequently encountered 
stored operating system is searched before a less frequently encountered stored 
operating system. 

17. (Original) The method of claim 1 , further comprising: 

indicating that the received packet corresponds to the wireless access device 
when the determined operating system does not match the stored operating systems. 

18. (Currently Amended) A system for detecting a wireless access device on a 
network, said system comprising: 
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means for receiving from the network a packet with an address; 

means for comparing the address with one or more registered addresses; means 

for determining an operating system associated with the address, when 

said comparing the address results in a match between the address and 

at least one of the registered addresses; 
means for comparing the determined operating system with one or more stored 

operating systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
means for indicating that the received packet corresponds to the wireless access 

device based on the first three octets of the address and when the 

detennined operating system matches at least one of the stored operating 

systems. 

19. (Currently Amended) A system for detecting a wireless access device on a 
network, said system comprising: 

at least one memory comprising: 

code that receives from the network a packet with an address; code that 
compares the address with one or more registered addresses; 

code that determines an operating system associated with the address, when 
said comparing the address results in a match between the address and 
at least one of the registered addresses; 
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code that compares the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems 
corresponds to the wireless access device; and 

code that indicates that the received packet corresponds to the wireless access 
device based on the first three octets of the address and when the 
determined operating system matches at least one of the stored operating 
systems; and 

at least one data processor that executes said code. 

20. (Original) The system of claim 19, wherein said code that receives further 
comprises: 

code that receives the address with information identifying a source of the 
packet. 

21 . (Original) The system of claim 20, further comprising: 

code that uses an organizationally unique identifier as the infomiation identifying 
the source. 

22. (Original) The system of claim 19, wherein said code that receives further 

comprises: 

code that receives the address based on passively monitoring the network. 
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23. (Original) The system of claim 19, wherein code that compares the address 

further comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

24. (Original) The system of claim 19, wherein said code that compares the 
address further comprises: 

code that determines whether a first organizationally unique identifier of the 
address is similar to a second organizationally unique identifier of at least one the 
registered addresses. 

25. (Original) The system of claim 19, wherein said code that determines the 
operating system further comprises: 

code that determines the operating system at the Intemet Protocol address 
associated with the address. 

26. (Original) The system of claim 25, wherein said code that determines the 
operating system further comprises: 

code that determining the operating system using an nmap. 

27. (Original) The system of claim 19, wherein said code that indicates further 
comprises: 

code that indicates the wireless access device is not authorized on the network. 
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28. (Original) The system of claim 19, further comprising: 

code that stores the one or more registered addresses, such that the one or 
more registered addresses are searchable. 

29. (Original) The system of claim 19, further comprising: 

code that stores a portion of at least one of the registered addresses, 

30. (Original) The system of claim 19, further comprising: 

code that uses an organizationally unique identifier as the portion. 

31 . (Original) The system of claim 30, further comprising: 

code that stores a plurality of the organizationally unique identifiers, such that the 
organizationally unique identifiers are searchable. 

32. (Original) The system of claim 31 , further comprising: 

code that stores the plurality of the organizationally unique identifiers, such that a 
more frequently encountered organizationally unique identifier is searched before a less 
frequently encountered organizationally unique identifier. 

33. (Original) The system of claim 19, further comprising; 
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code that stores the stored operating systems, such that a more frequently 

encountered stored operating system is searched before a less frequently encountered 

stored operating system. 

34. (Currently Amended) A computer program product for detecting a wireless 
access device on a network, the computer program product comprising: 

code that receives from the network a packet with an address; code that 

compares the address with one or more registered addresses; 
code that detennines an operating system associated with the address, when 

said comparing the address results in a match between. the address and 

at least one of the registered addresses; 
code that compares the detemiined operating system with one or more stored 

operating systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
code that indicates that the received packet corresponds to the wireless access 

device based on the first three octets of the address and when the 

detemnined operating system matches at least one of the stored operating 

systems; and 
at least one data processor that executes said code. 

35. (Original) The computer program product of claim 34, wherein said code that 
receives further comprises: 
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code that receives the address with information identifying a source of the 

paci<et. 

36. (Original) The computer program product of claim 35, further comprising: 
code that uses an organizationally unique identifier as the information identifying the 
source. 

37. (Original) The computer program product of claim 34, wherein said code that 
receives further comprises: 

code that receives the address based on passively monitoring the network. 

38. (Original) The computer program product of claim 34, wherein code that 
compares the address further comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

39. (Original) The computer program product of claim 34, wherein said code that 
compares the address further comprises: 

code that determines whether a first organizationally unique Identifier of the 
address is similar to a second organizationally unique identifier of at least one of the 
registered addresses. 
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40. (Original) The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that determines the operating system at the Intemet Protocol address 
associated with the address. 

41 . (Original) The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that determines the operating system using an nmap. 

. 42. (Original) The computer program product of claim 34, wherein said code that 
indicates further comprises: 

code that indicates the wireless access device is not authorized on the network. 

43. (Original) The computer program product of claim 34, further comprising: 
code that stores the one or more registered addresses, such that the one or 

more registered addresses are searchable. 

44. (Original) The computer program product of claim 34, further comprising: 
code that stores a portion of at least one of the registered addresses. 

45. (Original) The computer program product of claim 34, further comprising: 
code that uses an organizationally unique identifier as the portion. 
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46. (Original) The computer program product of claim 45, further comprising: 
code that stores a plurality of the organizationally unique identifiers, such that the 

organizationally unique identifiers are searchable. 

47. (Original) The computer program product of claim 46, further comprising: 
code that stores the plurality of the organizationally unique identifiers, such that a 

more frequently encountered organizationally unique identifier is searched before a less 
frequently encountered organizationally unique identifier. 

48. (Original) The computer program product of claim 34, further comprising: 
code that stores the stored operating systems, such that a more frequently 

encountered stored operating system is searched before a less frequently encountered 
stored operating system. 

49. (Currently Amended) A system comprising: 
a network; and 

a processor connected to the network, wherein the processor receives one or 
more packets , with an address, from the network, the processor further 

comprising: 

means for determining an operating system associated with at least one of 
the packets, when an Organizationally Unique Identifier included in 
the at least one packet represents a wireless access device; 
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means for comparing the determined operating system witli one or more 
wireless access device operating systems; and 

means for indicating that the at least one packet corresponds to the 
wireless access device[[,]] based on the first three octets of the 
address and when the determined operating system matches at 
least one of the wireless access device operating systems. 

50. (Currently Amended) A system comprising: 
a network; 

a first processor interfaced to the network; and 

a second processor interfaced to the network, wherein the second processor 
receives one or more packet s, with an address, from the network and the 
first processor, the second processor further comprising means for 
indicating that the first processor corresponds to a wireless access device 
based on [[an]] the first three octets of the address of the first processor 
and on an operating system of the first processor. 

51 . (Currently Amended) A system for detecting a wireless access device on a 
network, said system comprising: 

at least one memory comprising 

code that receives from the network a packet with an address; and 
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code that indicates that the received pacl<et con-esponds to the wireless access 
device based on the first three octets of the address and on an operating 
system associated with the received paclcet; and 

at least one processor for executing said code. 

52. (Currently Amended) A computer program product, tangibly embodied in a 
computer-readable storage medium, for detecting a wireless access device on a 
network and containing instructions which, when executed on a processor, perform a 
method comprising: 

receiving, from the network, a packet with an address; and 
indicating that the received packet corresponds to the wireless access device 
based on the first three octets of the address and on an operating system 
associated with the received packet. 
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